PRIVACY STATEMENT

Johnson & Johnson Family of Companies cares about your privacy and wants you to be familiar with how we collect, use, and disclose information. This Privacy Policy describes our practices in connection with information that we or our service providers collect online or offline (hereinafter the “Service”) operated and controlled by us. The Johnson & Johnson affiliate that you are engaged with is the entity responsible for the management of your personal information processed under this Privacy Policy. By providing personal information to us or by using the Service, you acknowledge that you have read and understand this Privacy Policy.

USE BY MINORS

The Service is not directed to individuals who are considered minors in their country of residence, and we request that these individuals not provide personal information through the Service. If your child has submitted Personal Information and you would like to request that such Personal Information be removed, please contact us as explained below under Contacting Us.

INFORMATION COLLECTION

In the course of your engagement with a Johnson & Johnson affiliate (hereinafter, referred as the “J&J”, “we” or “us”), J&J may have collected or will collect information about you and the services you provide to us. We refer to such information as “Personal Information.”

We may ask you to submit Personal Information in order for you to benefit from certain features and functionalities of the Service (such as order processing) or to participate in a particular activity (such as surveys). You will be informed what information is required and what information is optional.

We may combine the information you submit with other information we have collected from you, whether on- or offline, including, for example, your purchase history. We may also combine it with information we receive about you from other Johnson & Johnson affiliates.

You can find information about the information we collect and process, and how we use and disclose on the section “HOW WE USE AND DISCLOSE INFORMATION” in this document.

If you submit any personal information relating to another employee within your organization to us, you represent that:

1. you have obtained a consent from their side – where necessary – and/or you have informed them accordingly of their personal data processing in accordance with this Privacy Policy.

2. you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

SENSITIVE INFORMATION

Unless we specifically request or invite it, we ask that you not send us, and you not disclose, any sensitive personal information (e.g., Social Security numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health or medical conditions, sex life or sexual orientation, criminal background, or trade union membership, or biometric or genetic data) on or through the Service or otherwise to us.

AUTOMATIC INFORMATION COLLECTION AND USE

We and our service providers may collect certain information automatically as you navigate around the Service. On each site available to you, in the footer, you may access the Cookie Notice or Cookie Policy detailing the use of cookie technologies for the particular site - if applicable. The Cookie Notice or Policy includes information on how you may consent to these technologies, if required.

Please read the Cookie Policy available to you for detailed information about any cookies and other tracking technologies used on the Service. Except where allowed by applicable law, we place cookies after having received your consent through the cookie banner or preference center. The Cookie Policy includes information on how you may disable these technologies if such are enabled.

We and our service providers may also automatically collect and use information in the following ways:

Through your browser: Certain information is collected by most browsers, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, and Internet browser type and version. We may collect similar information, such as your device type and identifier, if you access the Service through a mobile device. We use this information to ensure that the Service functions properly.

IP address: Your IP address is a number that is automatically assigned to your computer by your Internet Service Provider. An IP address is identified and logged automatically in our server log files whenever a user visits the Service, along with the time of the visit and the pages visited. Collecting IP addresses is standard practice and is done automatically by many online services. We use IP addresses for purposes such as calculating Service usage levels, diagnosing server problems, and administering the Service. We may also derive your approximate location from your IP address.

Device Information: We may collect information about your mobile device, such as a unique device identifier, to understand how you use the Service.

HOW WE USE AND DISCLOSE INFORMATION

We use and disclose information you provide to us as described to you at the point of collection. Please see the section entitled “Choices and Access,” below, to learn how you may opt out of certain of our uses and disclosures.

Where required by applicable law, we will obtain your consent to our use of your personal information at the point of information collection. We may also use information from or about you as necessary to perform a contract, to comply with a legal obligation (for example, due to our pharmacovigilance obligations), or for our legitimate business interests.

The following chart contains more detailed information about how we use your personal information and the legal bases for such use.

We also disclose information collected through the Service:

• to our affiliates for the purposes described in this Privacy Policy. A list of our affiliates is available at https://johnsonandjohnson.gcs-web.com/financial-information/sec-filings (click on the link for Form 10K, Exhibit 21, under “SEC Filings”).

• to our third-party service providers who provide services such as website hosting and moderating, mobile application hosting, data analysis, transactions and payment processing, order fulfillment, infrastructure provision, IT services, customer service, e-mail and direct mail delivery services, auditing, and other services, in order to enable them to provide services;

• as permitted by applicable law, to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

In addition, we may use and disclose your information as we believe to be necessary or appropriate: (a) to comply with legal process or applicable law, which may include laws outside your country of residence;

(b) as permitted by applicable law to respond to requests from public and government authorities, which may include authorities outside your country of residence; (c) to enforce our terms and conditions; and

(d) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others. We may also use and disclose your information in other ways after obtaining your consent to do so.

We may use and disclose information we collect automatically as described above, under “Automatic Information Collection and Use.”

In addition, where allowed by applicable law, we may use and disclose information that is not in personally identifiable form for any purpose. If we combine information that is not in personally identifiable form with information that is identifiable (such as combining your name with your geographical location), we will treat the combined information as personal information as long as it is combined.

CHOICES AND ACCESS

How you can access, change, or delete your personal information

If you would like to review, correct, update, restrict, or delete your personal information, or if you would like to request an electronic copy of your personal information for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), please contact us via https://www.ap.jnj.com/privacycontactlisting. We will respond to your request as soon as reasonably practicable and consistent with applicable law. If circumstances cause any delay in our response, you will be promptly notified and provided with a date for our response. You may also visit the Service to update your online profile.

In your request, please make clear what Personal Information you would like to have changed or whether you would like to have your Personal Information suppressed from our database. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity. To do so, we may request additional Personal Information from you, such as email address or postal address.

Please note that we may need to retain certain information for recordkeeping purposes, to fulfill our legal obligations and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you place an order, you may not be able to change or delete the Personal Information provided until after the completion of such order).

CROSS-BORDER TRANSFER

Your personal information may be stored and processed in any country where we have facilities or service providers, and by using our Service or by providing consent to us (where required by law), your information may be transferred to countries outside of your country of residence, including to the United States, which may provide for different data protection rules than in your country. Nonetheless, appropriate contractual and other measures are in place to protect personal information when it is transferred to our affiliates or third parties in other countries.

SECURITY

We seek to use reasonable organizational, technical, and administrative measures designed to protect personal information under our control. Where appropriate these can include technical solutions like firewalls, intrusion detection or encryption and organizational and physical controls such as training staff identification of data incidents and risks or access restrictions.

To determine the level of protection required in each case, we appropriately assess the nature of your Personal Information together with the risk of a security incident occurring.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us in accordance with the Contact Us section below.

RETENTION PERIOD

We will retain your personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the Service to you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

THIRD PARTY SITES AND SERVICES

This Service may contain links to sites of third parties. This Privacy Policy does not address, and we are not responsible for, the privacy, information, or practices of any third parties, including any third party operating any site or online service (including, without limitation, any application) that is available through this Service or to which this Service contains a link. The availability of, or inclusion of a link to, any such site or property on the Service does not imply endorsement of it by us or by our affiliates.

CONTACTING US

The Johnson & Johnson affiliate that you are engaged with is the company responsible for collection, use, and disclosure of personal information under this Privacy Policy.

If       you      have      any      questions       about      this       Privacy      Policy,         please contact us         via https://www.ap.jnj.com/privacycontactlisting

ADDITIONAL PROVISIONS FOR SPECIFIC JURISDICTIONS

• Additional Provisions for Africa and Middle East

• Kenya

“Sensitive Information” is considered to include Personal Information revealing your race, health, status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of your children, parents, spouse or spouses, sex or your sexual orientation.

• Kingdom of Saudi Arabia

If you have any questions or comments about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or the laws of the Kingdom of Saudi Arabia, you may contact our Data Protection Officer at: [email protected]. You may lodge a complaint with the Saudi Data & AI Authority through the National Data Governance Platform about the collection or processing of the Personal Information.

• Nigeria

If you have any questions, comments or complaints about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or relevant Nigerian laws, you may contact our Data Protection Officer at: [email protected]. You may lodge a complaint with the National Information Technology Development Agency about the collection or processing of the Personal Information.

• South Africa

If you have any questions, comments or complaints about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or relevant South African laws, you may contact our Information Officer at [email protected]. You can lodge a complaint with the South African Information Regulator, which can be contacted at [email protected].

• United Arab Emirates

If you have any questions or comments about our collection, use or disclosure of Personal Information, you may contact our Data Protection Officer at: [email protected].

• Additional provisions for Americas

• Brazil

If you reside in Brazil, in addition to the rights described in the CHOICES AND ACCESS section, you will have the right to (i) obtain confirmation that we process your Personal Information, (ii)

request blocking or anonymization of your Personal Information if such Personal Data or its processing is unnecessary, excessive or unlawful, (iii) request portability of your Personal Information to another service provider, (iv) request deletion of your Personal Information that we process based on your consent, (v) request information about the public and private entities with which we share your Personal Information, (vi) request information about the consequences of not giving consent, and (vii) request the review of decisions made based solely on the automated processing of Personal Information that affect your interests.

If you determine that we have not complied with the Brazilian Data Protection Law and that this is a situation that directly affects you and, specifically, the way in which your data is managed individually (for example, if you have decided to withdraw consent, however the Company continues to send me email marketing), please send us an email to the Data Protection Officer at [email protected]. In your e-mail, please:

• Tell us the details of your complaint including relevant dates and third parties (if any);

• Provide copies of any relevant documents or correspondence;

• How you would prefer for us to contact you with our reply. We will:

• Acknowledge receipt of your complaint;

• Provide you with a written response to your complaint within 30 days - depending upon the complexity of your complaint this could be at an earlier or later time.

If you do not find our response to be satisfactory, you may lodge a complaint with the Brazilian Data Protection Authority – ANPD.

Our Data Protection Officer is Brazil is Patricia Vicinelli. You may contact our Data Protection Officer if you have questions about the interpretation or operation of this notice at [email protected].

• Canada

In addition to the purposes listed in the section “How We Use and Disclose Information”, we may also collect and process Personal Information without your consent where this is permitted or required by applicable Canadian law.

In addition to the purposes listed in Section 1, we may also collect and process Personal Information without your consent where this is permitted or required by applicable Canadian law.

Except as above, where “legitimate interests” are specified in this section as the reason for processing your Personal Information, informed consent shall apply instead, except where such purposes are essential and will not be subject to consent options.

If you have questions or complaints about our processing of Personal Information, please contact the “Data Privacy Officer, Canada.” by email at [email protected].

• Colombia

If you believe that we have not complied with this Notice or relevant Colombian laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this

Policy. You may lodge a complaint with the Superintendencia de Industria y Comercio . Further information will be available at  Superintendencia de Industria y Comercio (sic.gov.co)

• Costa Rica

If you would believe that we have not complied with this Notice or relevant Costa Rican laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this Policy. You may lodge a complaint with the National Data Protection Authority (Agencia de Protección de Datos de los Habitantes -Prodhab-). Further information will be available at www.prodhab.go.cr.

• Mexico

If you believe that we have not complied with this Notice or relevant Mexican laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this Policy. You may lodge a complaint with the National Data Protection Authority (Instituto Nacional para la Transparencia, Acceso a la Información y Protección de Datos). Further information will be available at home.inai.org.mx.

• Panama

If you reside in Panama, in addition to the rights described in the CHOICES AND ACCESS section, you will have the right to (i) to object to the processing of your Personal Data when there are legitimate and well-founded grounds; (ii) deny to provide your Personal Data or to be subject to certain data processing, and (iii) request portability of your Personal Information to another service provider.

If you believe that we have not complied with this Notice or relevant Panamanian laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this Policy. You may lodge a complaint with the National Data Protection Authority (Autoridad Nacional de Transparencia y Acceso a la Información – ANTAI). Further information will be available at www.antai.gob.pa.

• Peru

If you reside in Peru, in addition to the rights described in the CHOICES AND ACCESS section, you will have the right to: (i) when applicable, prevent your data from being provided, especially when it affects your fundamental rights; (iii) to object to the processing when there are legitimate and well-founded grounds relating to a specific personal situation; (iv) not to be subjected to a decision with legal effects on you that significantly affects you, based solely on a processing of personal data intended to evaluate certain aspects of your personality or conduct, unless this occurs within the framework of the negotiation, conclusion or execution of a contract or in cases of evaluation for purposes of incorporation into a public entity, according to law, without prejudice to the possibility of defending your point of view, in order to safeguard your legitimate interest; (v) obtain the corresponding compensation, in accordance with the law if you are affected as a result of a breach of this Law by us.

If you believe that we have not complied with this Notice or relevant Peruvian laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this Policy.

You may lodge a complaint with the National Data Protection Authority (Autoridad de Protección de Datos Personales). Further information will be available at www.gob.pe/anpd.

• Uruguay

If you would like to request to correct, update or delete your Personal Information, or if you believe that we have not complied with this Notice or relevant Uruguayan laws, you may file a claim with the J&J affiliate, using the channels indicated in the “Contact Us” section of this Policy. You may lodge a complaint with the National Data Protection Authority (Unidad Reguladora y de Control de Datos Personales). Further information will be available at www.gub.uy/unidad- reguladora-control-datos-personales/.

• Additional Provisions for Asia & Pacific

• Australia & New Zealand

If you have any questions, comments or complaints about J&J’s collection, use or disclosure of Personal Information, or if you believe that J&J has not complied with this Notice or relevant Australian or New Zealand laws, you may contact the Privacy Officer of J&J at RA-JNJAU- [email protected].

• China

Notwithstanding anything contained above to the contrary, we collect and process Personal Information about you in accordance with the legal bases provided under Chinese law and necessity for procurement management and administration.

As noted in Section Cross-Border Transfer, foreign transfers of Personal Information will be made in accordance with applicable law.

Sensitive Information is Personal Information that the breach or illegal use of information may easily lead to the infringement of your personal dignity or harm to personal or property safety. Personal Information about your Dependents under the age of fourteen is Sensitive Information, which is only collected and shared with your consent (where applicable).

In principle, Personal Information generated or collected within the territory of Mainland China will be processed and stored within Mainland China. To fulfill the purposes described in Section 8 of this Notice, your Personal Information may be disclosed to members of the Johnson & Johnson Family of Companies and authorized third parties located in countries or regions outside Mainland China, including but not limited to the United States, countries within the European Economic Area (EEA), Singapore, Australia, and New Zealand. We will strictly abide by relevant laws and regulations as well as the Company’s information security policies to ensure the security of your Personal Information during the transfer and will require data recipients to provide adequate protection for your Personal Information through contractual clauses or other means. Requests for the exercise of access and other rights in respect to Personal Information disclosed to an overseas recipients can be directed to us via the information provided in the “Contact us” section.

If we process Personal Information based on your consent, you may withdraw your consent at any time by contacting us via the information provided in the “Contact us” section.

If you have any questions, comments or complaints about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or relevant

laws, you may contact the Personal Information Protection Officer at Building A, Xinyan Mansion, No.65 Guiqing Road, Xuhui District, Shanghai, China 200233. Alternatively, you can lodge a complaint by contacting us via the information provided in the “Contact us” section.

To the extent inconsistent with the provisions of this Notice, including but not limited to definitions (e.g., sensitive Personal Information), China’s Cybersecurity Law, Personal Information Protection Law, their implementing measures and other Chinese laws and regulations in relation to cybersecurity and data protection will prevail.

• Hong Kong

You have the right to request access to and correction of Personal Information held by us about you. If you wish to access or correct your personal data, please contact our data protection officer at [email protected].

• India

You may also lodge a complaint with our Grievance Officer via [email protected].

• Indonesia:

Your Privacy Rights. You have the right to request to review the personal information we have collected about you, as well as the right to request correction, terminate processing (including deletion and/or destruction), blocking, provision of a copy of your personal data, object to any automated decision making involved in personal data processing (as relevant) and data portability. You may exercise your privacy rights by visiting Contacting Us section as mentioned above.

Security measures. We respect the importance of confidentiality and security of your personal data. We will always implement the appropriate organizational, technical, and administrative measures to ensure the integrity, availability, and security of your personal data, that are consistent with industry practice.

• Japan

We will only use “Individual Number” as defined under Article 2, Paragraph 5 of the Act on the Use of Numbers to Identify a Specific individual in the Administrative Procedure (Act No. 27, of May 2013) consistent with applicable law.

• South Korea

When we destroy Personal Information, we will do so in a manner that makes it unreadable or non-reconstructable.

You may contact our privacy officer of the company at [email protected]. Respective local entity’s Privacy Policy is available at the following URLs:

•  Jassen Korea, Ltd.: https://www.janssen.com/korea/etc/privacy

•  Johnson & Johnson Medical Korea, Ltd.: https://www.jnjmedtech.com/ko-KR/policies-privacy

•  Johnson & Johnson Vision Korea, Ltd.: https://web.acuvue.co.kr/terms/privacy-policy

•  AMO Asia, Ltd.: https://surgical.jnjvision.kr/privacy-policy

• Taiwan

You have the right to request to review the Personal Information we have collected about you, as well as the right to request correction, deletion, and restriction of our use of such information. You can make a request at [email protected].

• Thailand

If you have any questions, comments or complaints about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or relevant laws, you may contact the Data Protection Officer at [email protected]. Alternatively, you can lodge a complaint with the Personal Data Committee of Thailand.

• Vietnam

With respect to section 1: Notwithstanding anything contained above to the contrary, we collect and process Personal Information about you in accordance with the legal bases provided under Vietnamese law. References to processing based on our “legitimate interest” in the relevant sections of the Notice are subject to your prior consent. You may agree to the above processing purposes in full or in part by checking the related boxes in the consent form.

With respect to the purposes for which we process Personal Information: we will process your information with your consent for the purposes mentioned in Section 8.

We may communicate marketing and advertisement on our products and the products of our business partners, after obtaining your prior consent. Such communications may be in the form of emails, text messages, phone calls, chatbot, or other means. Our communications will remain reasonable, avoiding excessive or intrusive messaging.

We protect your Personal Information from the moment we collect it and until its deletion or destruction. In the case of a data incident (loss, disclosure, unauthorized access, etc.) affecting your Personal Information, you may experience consequences or damages such as exposure of your Personal Information (which may include Sensitive Information), identity theft, financial harm, reputational damage, and increased vulnerability to targeted scams or fraud attempts.

If you have any questions, comments or complaints about our collection, use or disclosure of Personal Information, or if you believe that we have not complied with this Notice or relevant laws, you may contact the Personal Information Protection Officer at [email protected]. Alternatively, you can lodge a complaint with the local authorities.

To the extent inconsistent with the provisions of this Notice, including but not limited to definitions (e.g., Sensitive Personal Information), Vietnam’s Cybersecurity Law, Personal Data Protection Decree, their implementing measures and other Vietnamese laws and regulations in relation to cybersecurity and data protection will prevail.

• Additional Provisions for Europe

• European Economic Area or EEA

We may transfer your Personal Information to countries located outside of the EEA. Some of these countries are recognized by the European Commission as providing an adequate level of protection according to EEA standards (the full list of these countries is available http://europa.eu). With regard to transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate safeguards, such as EU Standard Contractual Clauses, to protect your Personal Information. You may obtain a copy of these measures by contacting our Data Protection Officer at [email protected]. You may also contact our Data Protection Officer if you have questions about the interpretation or operation of this notice. You may lodge a complaint with a supervisory authority for your country. You may find the list of supervisory authorities under https://edpb.europa.eu/about-edpb/about- edpb/members_en or by the search function of the European Commission website.

The local Johnson & Johnson affiliate that you are engaged with is the entity responsible is the data controller for your Personal Information.

• Switzerland

We may transfer your personal information to countries located outside of Switzerland, in which we have affiliates or service providers. Your data may therefore be processed in Europe, the United States, the Philippines and India; in exceptional cases, in any country in the world. Such countries may provide for different data protection rules than in Switzerland. Some countries outside of Switzerland are recognized as providing an adequate level of data protection; some, however, are not. For transfers to countries not recognized as providing an adequate level of data protection (such as, amongst others, the United States, the Philippines and India), we have ensured that adequate measures are in place, including by ensuring that the recipient is bound by the revised European Commission’s Standard Contractual Clauses (including the necessary adjustments and additions made for use under Swiss data protection law) to appropriately protect your Personal Information.

The local Johnson & Johnson affiliate with the professional relationship with you or your employer is the data controller for your personal information.

You may contact our Data Protection Officer at [email protected] for data protection concerns.

• Turkey

The local Johnson & Johnson affiliate that you are engaged is the data controller for your Personal Information. Your Personal Information will be deleted or anonymized at the end of the applicable retention period. You may lodge a complaint with a supervisory authority in Turkey according to the Turkish Data Protection Law and applicable Turkish legislation.

• United Kingdom or UK

We may transfer your Personal Information outside of the UK. Some of these countries are recognized by the UK as providing an adequate level of protection according to UK standards. The UK will continue to permit the transfer of Personal Information to the EEA and any countries that are covered by a UK Government adequacy decision (the full list of these countries is available here https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/). About transfers from the UK